Windows – IIS 7 – allow http for part of site, https for rest

httphttpsiisiis-7windows

In IIS 7, is there a way to set two urls on the same site to allow http and https, and the rest to be https only?

 - http://mysite/url1 or https://mysite/url1 is accepted and stays on that protocol.
 - http://mysite/url2 or https://mysite/url2 is accepted and stays on that protocol.
 - any other item, i.e. http://mysite/whatever redirects to https://mysite/whatever
 - https://mysite/whatever is accepted.

Edited because first question wasn't clear enough.

Best Answer

The most friendly way to do this is with IIS URL Rewrite since it won't throw an error if they arrive by HTTP but it will redirect to HTTPS for them. You can set the rule to redirect to https for all pages except for the 2 that you need (and any images, css, or other dependencies that can also remain HTTP).

Here's a link to get started: http://tinyurl.com/4lj4v5g.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Iis – How to restrict access to web pages for HTTPS

You can certainly limit a folder/virtual-directory/application in IIS to HTTPS only (HTTP requests will be redirected to HTTPS).

The method depends on the IIS version.

IIS7 and later (for Vista/2008/Win7/2008R2):

In the containing Web Site, ensure SSL is configured (i.e. a HTTPS/SSL binding and certificate are configured).
Select the right location in the folder tree
Use SSL Settings to select "Require SSL".

IIS6 and earlier:

In the properties of the web site configure certificate and SSL port.
In the properties of applicable folder in the Directory Security Tab click on Edit and select Require Secure Channel (SSL)

Best Answer

Related Solutions

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

Iis – How to restrict access to web pages for HTTPS

Related Topic